Safety system for a motor vehicle

ABSTRACT

A safety system for a motor vehicle having an internal-combustion engine. Independent quantities are used for the engine control and for the monitoring of the engine control. Control of the internal-combustion engine is performed, for example, by way of an operating parameter characterizing the engine load. Preferably, monitoring of the engine control is integrated into a traction control system, in which case the desired value for a quantity characterizing the vehicle propulsion, such as the output torque, is transmitted by the engine control to the monitoring system, while the actual output torque is determined in the traction control system from the rotational wheel speed. If a fault is recognized in the traction control system during the continuous comparison of desired values and actual values, a signal is transmitted back to the engine control unit, to influence the engine control.

BACKGROUND AND SUMMARY OF THE INVENTION

The invention relates to a safety system for a motor vehicle having aninternal-combustion engine.

German Patent Document 39 14 167 A1 discloses a safety system for amotor vehicle internal-combustion engine in which the output torque of atransmission is monitored. If the determined torque exceeds a givenminimal value, when the accelerator pedal is not depressed, operation ofthe internal-combustion engine is interrupted. This system has thedisadvantage that it engages only when the accelerator pedal is notdepressed. It cannot recognize other faulty functions.

In addition, systems are known which the throttle valve position ismonitored. These systems have the disadvantage that a single quantity isused both for controlling the internal-combustion engine and formonitoring. Should a fault occur in this sensing, both the enginecontrol and the monitoring device will operate with the wrong quantity.Another problem of this monitoring device occurs in the case ofinternal-combustion engines with a dynamic torque adjustment in which,particularly in dynamic operating conditions, there is no directrelationship between the throttle valve position and the engine load.Thus, in the case of such internal-combustion engines, monitoring cannotoccur on the basis of the throttle valve position.

It is an object of the present invention to provide a safety system fora motor vehicle with an internal-combustion engine which ensures thesafety of the motor vehicle in all operating ranges, and which can alsobe used for internal-combustion engines with a dynamic torqueadjustment.

These and other objects and advantages are achieved according to theinvention by using distinct independent quantities for controlling theengine on the one hand and for monitoring engine control on the other.According to the invention, control of the internal-combustion enginemay be performed, for example, by way of an operating parameterindicative of engine load. Preferably, monitoring of the engine controlis integrated into a traction control system, in which case the desiredvalue for a quantity indicative of vehicle propulsion, such as theoutput torque, is transmitted by the engine control to the monitoringsystem, while the actual output torque is determined in the tractioncontrol system from the rotational wheel speed. If a fault is recognizedin the traction control system during the continuous comparison ofdesired values and actual values, a signal is transmitted back to theengine control unit for influencing the engine control.

The safety system according to the invention has the advantage that,because independent quantities are used for the engine control and forthe monitoring, if the sensing of one of the two quantities or one ofthe two control units fails, the other control unit can continue tooperate properly, and to ensure at least an emergency operation orrender the internal-combustion engine inoperative.

When the safety system is used in a vehicle having a traction controlsystem, it can be integrated in the traction control system. This hasthe advantage that the rotational wheel speed is detected and processeddirectly by the traction control system. In addition, the tractioncontrol system has a high-priority access to the torque indication inthe engine control. Existing connections can therefore be used for thecommunication between the safety system and the engine control.

Other objects, advantages and novel features of the present inventionwill become apparent from the following detailed description of theinvention when considered in conjunction with the accompanying drawings.

BRIEF DESCRIPTION OF THE DRAWINGS

The single FIGURE shows the basic construction of a safety systemaccording to the invention.

DETAILED DESCRIPTION OF THE DRAWINGS

The position FP of an accelerator pedal 1, at least one operatingparameter indicative of the operating condition of theinternal-combustion engine (such as the actual engine load, load_(act))and at least one quantity characterizing the vehicle propulsion (such asthe rotational speed of the wheel n_(wheel)) are determined andtransmitted by way of data lines to the analyzing devices 4, 13.According to the embodiment, the load detection takes place indirectlyby measuring the actual air mass flow m_(act) in the intake pipe 2 ofthe internal-combustion engine (not shown). The actual air mass flowm_(act) can, for example, be adjusted by means of a throttle valve 5 andcan be determined by means of a hot-wire mass air flow meter 6.

The first analyzing device 4 is hereinafter referred to as an enginecontrol unit. In the engine control unit 4, in block 7, a vehiclepropulsion demand is determined from the accelerator pedal position FP(for example, a torque desired by the driver M_(des-FP)) and in block 8a desired value is determined therefrom for the operating parameterindicative of the operating condition of the internal-combustion engine(for example, a desired load value, load_(des)). Simultaneously, inblock 9, an actual load value load_(act) is determined from the actualair mass flow m_(act) and in block 10 is compared with the desired loadvalue load_(des) to determine a differential value Δ_(load). From thisdifferential value Δ_(load), a desired throttle valve value α_(des) isthen determined in block 11 and by means of a throttle valve adjustment(not shown), the throttle valve 5 is adjusted to this desired valueα_(des).

The above-described steps are used for controlling the power of theinternal-combustion engine or of the vehicle. For this purpose,additional operating parameters, such as the rotational engine speed orthe engine temperature are provided to the engine control unit 4. Also,in addition to the throttle valve position, the engine control unit 4influences other operating parameters, such as the ignition point (block15) or the fuel quantity (block 16). Such processes are known from thestate of the art (for example, from German Patent Document DE 43 15 885C1) and will not be explained here in detail.

In the event of operating disturbances of the internal-combustionengine, for example, with respect to the sensing of the air mass flowm_(act) or with respect to the adjustment of the throttle valve positionα_(des), vehicle operation may be impaired, and the operating safety ofthe vehicle may even be influenced considerably. In particular, thethrottle valve 5 may jam in the fully opened position. It is thereforenecessary to provide a safety system which permits a safe operation ofthe vehicle despite the operating disturbance, or at least ensures thatthe internal-combustion engine is switched off.

According to the embodiment illustrated in the drawing, a sensor (notshown) for sensing a rotational wheel speed n_(wheel) is provided forthis purpose on at least one vehicle wheel 3. By way of a data line,this rotational wheel speed n_(wheel) is transmitted to a secondanalyzing device 13, which is referably a traction control system.(However, a different control unit may also be used.) Traction controlsystems are also known from the state of the art, and will therefore bediscussed only briefly.

The system illustrated in the drawing is a wheel slip control system,referred to hereinafter as an ASR-system. In such ASR-systems, therotational speeds n_(wheel) of several vehicle wheels 3 are comparedwith one another to detect operating conditions in which there is anexcessive wheel slip. If such a condition is recognized, the ASR controlunit 13 determines a reduced desired torque M_(des-ASR) and transmits itto the engine control unit 4. In the engine control unit 4, this reduceddesired torque M_(des-ASR) is given a higher priority than the torquedesired by the driver M_(des-FP). This means that, as long as a reduceddesired torque M_(des-ASR) is present, engine control is carried out onthe basis of the reduced desired torque M_(des-ASR). Only if no reduceddesired torque M_(des-ASR) is present, will the engine control beperformed on the basis of the torque desired by the driver M_(des-FP).The determination of the desired torque M_(des-ASR) takes place in theASR control unit 13 (block 12) and is transmitted from there to theengine control unit 4 (block 8).

For the monitoring of the engine control, in addition, the actual outputtorque M_(act) of the vehicle is determined in the ASR-control unit 13.For this purpose, the rotational speed signal n_(wheel) isdifferentiated with respect to time in block 12, and is multiplied bythe vehicle mass. The output torque M_(act) is then transmitted to block14, which also receives the desired torque indicated the driverM_(des-FP), provided by the engine control unit 4. These two inputquantities (M_(act) and M_(des-FP)) are continuously compared with oneanother in block 14 and a corresponding differential value ΔM iscalculated. In the normal operation of the internal-combustion engine,apart from fairly small fluctuations, the two quantities M_(des-FP) andM_(act) should essentially correspond to one another with deviationsoccurring, only when there is a fault function in signal detection,signal transmission or processing. For this reason, the differentialvalue ΔM is continuously compared with a given threshold valueM_(thresh). If it is determined that the differential value ΔM, exceedsthe threshold value M_(thresh), for a given time period, a fault isrecognized.

Upon the occurrence of such a fault, different measures can be taken. Inthe simplest case, a fault signal generated in block 14 is indicated tothe driver and/or is stored in a memory for a later analysis. However,the operating safety of the internal-combustion engine cannot be ensuredon the basis of this measure alone. It may also be necessary tointervene in the engine control. One possibility is to determine acorrected desired torque M_(corr) in block 14 on the basis of thedifferential value ΔM, and transmit it to the engine control unit 4. Thedata line between block 12 in the ASR control unit 13 and block 8 in theengine control unit 4 which is provided for the ASR function ispreferably used for this purpose. As a result, the corrected desiredtorque M_(copp) is also processed with a higher priority in the enginecontrol unit 4. Also, an additional data line is unnecessary.

It may occur in the operation of the internal-combustion engine that acorrected desired torque M_(corr) is generated based on the monitoringfunction, and simultaneously a reduced desired torque M_(des-ASR) isgenerated based on the traction control. In this case, it is possible toprovide another block for comparing the two desired torques M_(des-ASR),M_(corr), with the smaller of the two desired torques M_(des-ASR),M_(corr) being transmitted to the engine control unit 4.

Another possible response to the recognition of a fault conditionconsists of reducing the output torque M_(actual) by an ignitionintervention, for example, a temporary advance or retarding of theignition point. For this purpose, a corresponding fault signal isgenerated in block 14 and is transmitted via a data line to the ignitionadjustment unit (block 15) in the engine control unit 4. If also thismeasure is not effective to limit the output torque M_(act) to a valueM_(act) <=M_(des-FP), the internal-combustion engine must possibly berendered inoperative by switching off the fuel. For this purpose, acorresponding fault signal is again generated in block 14 and istransmitted by way of another data line to the fuel distributing system(block 16) in the engine control unit 4.

Block 14 therefore represents the actual module for monitoring theinternal-combustion engine. Here, the torque desired by the driverM_(des-FP) and output torque M_(act) are compared and, in the case of adeviation, corresponding signals are sent to the engine control unit 4to prevent an excessive output torque M_(act), by reducing the loadindication (block 8), ignition intervention (block 15), and/orinterruption of the fuel supply 16.

The exchange of data or measuring signals between the individual sensorsand analyzing devices 4, 4' can be implemented by way of arbitrary dataconnections. In the simplest case, all units are connected by simpleelectric lines. However, the data exchange can also take place by way ofa data bus, if one is provided in the vehicle, that all information isavailable on all connected units. If either the engine control unit 4 orthe data bus fails, the throttle valve adjustment generally has amechanical device, for example, in the form of a spring, which moves thethrottle valve 5 into the closing position so that theinternal-combustion engine is operated in the idling mode. Of course, itcan also be provided in this case that the internal-combustion engine isstopped by switching off the fuel supply.

The described safety system has the advantage that independentquantities can be used for controlling and monitoring theinternal-combustion engine. For the purpose of control, any arbitraryoperating quantity may be detected which characterizes the engine load(load_(act)). In addition to or instead of the momentary air mass flowm_(act), the suction pipe pressure P_(air) and/or the throttle valveposition α_(act) can also be used. To control the internal-combustionengine, any arbitrary quantity which influences the engine loadload_(act), such as the throttle valve position α_(act), is alsoadjusted by the engine control unit 4. For the monitoring, the outputtorque M_(act) of the vehicle is also determined on the basis of therotational wheel speed n_(wheel).

If the detection of the air mass flow m_(act) fails, the operation ofthe engine regulating will be faulty. However, the safety systemoperates independently of this input quantity and can therefore, asdescribed above, switch the internal-combustion engine over to anemergency operation or stop it. If, on the other hand, the sensing ofthe rotational wheel speed n_(wheel) should fail, the traction controlsystem and the safety system will also fail; but the engine control cancontinue to operate properly on the basis of the air mass flow m_(act).For the improbable case that the sensing of both the air mass flowm_(act) and the rotational wheel speed n_(wheel) should fail, secureoperation of the internal-combustion engine is, however, no longerpossible since both the engine control and the safety system will fail.In this case, the internal-combustion engine must be stopped.

Another important advantage of the invention is that the describedsafety system can also be used in vehicles with a so-called dynamictorque adjustment. Since, in such engine controls, particularly undertransient driving conditions, there is no longer a direct couplingbetween the throttle valve position α_(act) and the torque desired bythe driver M_(des-FP), it is no longer possible to carry out themonitoring on the basis of the throttle valve angle α_(act).

According to the above embodiment of the invention, the torque desiredby the driver M_(des-FP) is determined on the basis of the acceleratorpedal position FP. However, it is also possible to use other suitableinput quantities for this purpose, such as the output signal of anautomatic speed control. Additional possibilities also exist for sensingthe rotational wheel speed n_(wheel), in addition to the sensing of anindividual rotational wheel speed described in the embodiment. Forexample, the rotational speeds of several or all wheels 3 can bemeasured, and from them an effective rotational wheel speed n_(wheel)can be determined in an arbitrary manner. In principle, the outputtorque M_(act) can, however, be determined at any point of thetransmission line. Only the definition of the torque interface must beadapted to the selected point in the transmission line.

As indicated above, it is advantageous for the safety system to providea traction control system in the vehicle. This may be a simple system,for example an antilock brake system, or it may be a higher-expendituresystem, such as a wheel slip control system or a driving dynamicscontrol system. In the case of such traction control systems, therotational speeds of individual wheels or of all wheels 3 are sensed andanalyzed. No additional constructional expenditures are thereforerequired for the safety system because all sensors and analyzing devicesare already required for other tasks. In this case, the safety system ispreferably integrated in the traction control system 13, because ahigh-priority access to the engine control unit 4 already exists for thetraction control system 4. Therefore, instead of the reduced desiredtorque M_(des-ASR), the corrected desired torque M_(coor) of the safetysystem is simply applied to the output of the traction control system13. The communication between the two control units 4, 13 therefore neednot be especially adapted to the safety system. In principle, it is alsopossible to house both control units, 4, 13, together with additionalfunctions in a common control unit. In addition, it is possible toprovide a separate control unit for the monitoring module, in which casethe actual output torque M_(act) will be transmitted from the ASRcontrol unit 13 or another suitable control unit to the monitoringmodule.

The safety system described by means of the drawing represents only onepossible embodiment. The scope of the invention, however, is not limitedto the shown example. On the contrary, the idea of the invention can beapplied to almost all engine controls. The engine load load_(actual) isnot the sole characterizing quantity for the operating condition of theinternal-combustion engine. The operating condition can a so becharacterized, for example, by the efficiency (for example, as afunction of the ignition point, air/fuel ratio or fuel switch-off), thenumber of consuming devices (such as the air-conditioning system or theelectric generator), or the condition parameters for any of thefunctions: cylinder switch-off, sequential fuel switch-off, gear, gearchange, and power transmission. Naturally, a combination of thesequantities or additional quantities can also be used. In principle, allquantities can be used as the input quantity which influence thecondition of the internal-combustion engine and thus directly orindirectly the propulsion of the vehicle.

In addition to the desired torque, the desired acceleration or thedesired rotational speed (measured on the engine shaft, the transmissionshaft or directly at the vehicle wheel) can also be used as the vehiclepropulsion requirement. Furthermore, the fuel quantity indication, thethrottle valve angle requirement or desired values for the air mass flowor the load can also be used. In addition to the rotational wheel speed,the rotational speed, the acceleration or the torque can be determinedas the measuring quantity for the vehicle propulsion at any point in thetransmission line. In addition, the vehicle yaw angle, the vehicle pitchangle or the vehicle rolling angle can also be used.

The decisive principle of the invention is only to determine two desiredvalues based on the basis of the driver's input: one desired valuecorresponding to the desired vehicle propulsion, and the otherconcerning a quantity for controlling or regulating theinternal-combustion engine to adjust the desired vehicle propulsion. Inaddition, two independent measuring values are sensed from each of whichone actual value is determined which is assigned to the correspondingdesired value. Finally, two independent control units are provided, oneof which is used to controlling or regulate the internal-combustionengine, and the other of which monitors the operation of theinternal-combustion engine based on the desired and actual values forthe vehicle propulsion, if necessary, sends control commands to thefirst control unit to correct a faulty function or to render theinternal-combustion engine inoperative.

Although the invention has been described and illustrated in detail, itis to be clearly understood that the same is by way of illustration andexample, and is not to be taken by way of limitation. The spirit andscope of the present invention are to be limited only by the terms ofthe appended claims.

What is claimed is:
 1. Safety system for a motor vehicle having aninternal-combustion engine, comprising:a sensor for measuringaccelerator pedal position; means for determining an actual value for atleast one operating parameter indicative of an operating condition ofthe internal-combustion engine; means for determining a value for leastone quantity indicative of a vehicle propulsion; a first analyzingdevice including means fordetermining a desired vehicle propulsion valueand a desired value for the at least one operating parameter indicativeof said operating condition of the internal combustion engine, based onmeasured accelerator pedal position; and adjusting the operatingparameter indicative of the operating condition of theinternal-combustion engine to correspond to the determined desired valuethereof; and a second analyzing device including means fordetermining anactual vehicle propulsion value based on the at least one quantityindicative of vehicle propulsion, continuously comparing the desired andactual vehicle propulsion values; and recognizing a fault in theoperation of the system being recognized when the actual value deviatesfrom the desired value.
 2. Safety system according to claim 1, wherein adeviation is recognized when a difference value between the desiredvehicle propulsion value and the actual vehicle propulsion value exceedsa preset threshold value for a preset time period.
 3. Safety systemaccording to claim 1, wherein when a fault is recognized, in the secondanalyzing device, a corrected vehicle propulsion value is determinedbased on the difference value and is transmitted to the first analyzingdevice with a higher priority relative to the desired propulsion value.4. Safety system according to claim 1, wherein when a fault isrecognized, the second analyzing device transmits a signal for reducingthe actual vehicle propulsion value according to an interventionadjustment in the first analyzing device.
 5. Safety system according toclaim 4, wherein when, despite an ignition intervention, the actualvehicle propulsion value exceeds the desired vehicle propulsion value,the second analyzing device transmits a fuel switch-off signal to a fueldistribution device in the first analyzing device.
 6. Safety systemaccording to claim 1, wherein when a deviation is recognized, a faultsignal is generated and stored in a memory.
 7. Safety system accordingto claim 6, wherein when a deviation is recognized, a fault signal isalso indicated to a driver of the vehicle.
 8. Safety system according toclaim 1, wherein the second analyzing device is a traction controlsystem.
 9. Safety system according to claim 1, wherein:in addition toaccelerator pedal position, operating parameters characterizing engineload and output torque of the internal-combustion engine are detected;in the first analyzing device, a torque desired by the driver on thebasis of the accelerator pedal position and a desired load value on thebasis of the desired torque value are determined, and the actual loadvalue is adjusted to the desired load value by influencing an operatingparameter influencing the engine load; and in the second analyzingdevice, actual output torque is determined based on the wheel speed andis continuously compared with the desired torque value input by adriver, which is provided by the first analyzing device, and a fault isrecognized if the actual output torque deviates from the desired torque.